EUVD-2026-49993
GHSA-qxx3-9m9g-gvwc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Low-privilege network-accessible SQL injection causing limited data exposure and modification.
Primary rating from Vendor (Tanium).
CVSS VectorVendor: Tanium
Lifecycle Timeline
2DescriptionCVE.org
Tanium addressed a SQL injection vulnerability in Patch.
AnalysisAI
SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the backend database via crafted network requests. The vulnerability affects all versions prior to the vendor-released patch identified in advisory TAN-2026-019. No public exploit code or active exploitation has been reported.
Technical ContextAI
The vulnerability resides in the Tanium Patch module, a component of the Tanium endpoint management suite responsible for deploying software updates. It stems from improper neutralization of special elements used in SQL commands (CWE-89), likely occurring when user-supplied input is incorporated into a database query without adequate sanitization. The CPE designation cpe:2.3:a:tanium:patch:*:*:*:*:*:*:*:* covers all unpatched versions of the Patch module.
RemediationAI
Apply the vendor-supplied update for Tanium Patch as detailed in advisory TAN-2026-019 (https://security.tanium.com/TAN-2026-019). The advisory should be consulted for the exact patched version. No temporary mitigations are described; as a general precaution, restrict access to the Tanium console to trusted administrators until the patch is deployed.
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. Rated medium s
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote atta
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fil
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), t
An issue was discovered in GNU patch through 2.7.6. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Tanium addressed an incorrect default permissions vulnerability in Patch. [CVSS 6.5 MEDIUM]
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. Rated mediu
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fa
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an exce
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting i
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today